GLAS cannot track taint through Class Level Variables (Java)
GLAS is unable to track tainted variables when assigned to class level variables:
public class Test extends HttpServlet {
String userInput;
String notUserInput = "REFRESH DB";
@Override
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
this.userInput = request.getParameter("input");
// Rule works fine here
vulnerableFunction(userInput);
executeFunction1(userInput);
executeFunction2();
refreshDb();
}
private void executeFunction1(String userInput){
//Rule works fine here
vulnerableFunction(userInput);
}
private void executeFunction2(){
//Rule fails to track taint in this scenario
vulnerableFunction(userInput);
}
}
Sample Playground link showing this behavior on the Semgrep Pro Engine: https://semgrep.dev/playground/s/Ped60
GitLab's GLAS Engine Exhibits the same behavior.